Re: logcheck - please send email when someone reboots !!
hi ya
On Sun, 23 Feb 2003, Sebastian Haase wrote:
> Hi,
> I administer a few Intel pentium machines running Woody.
> I have the logcheck package installed on all of them,
> because I think it's a good habit to monitor what's going
> on "inside those machines".
> BUT somehow logcheck thinks it's not worth reporting
> anything when someone accidentally [:-)] presses the
> RESET-button or even a kernel OOps (!). Also problems
> like "stale NFS" don't get reported.
>
> I didn't do much to the configuration files. I configured
> logcheck as server.
>
> How do have it send me every "somewhat" serious message
> from the kernel ?
in /etc/rc.sysinit or /etc/rc.d/rc.local other "bootup scripts"
#
date > /tmp/x
hostname -f >> /tmp/x
#
mail -s "help - i've been rebooted" you < /tmp/x
#
if log check is not checking other stuff...
- add it to its lists to check for
or on each server, use a new script via cron
df and/or ls -la /net/*/foo/bar
cat /proc/mounts too
and email the result it its not as expected
teach people or put into corp security policty that
nobody reboots any servers that other people mounts
( mail, web, home, printers, etc
- use automounters for all servers
people can reboot their own local pc on their desk as often as
they like .. as long as nobody else mounts that pc to other pcs/servers
c ya
alvin
> I think this should even be reported as a BUG - but I
> don't know how to do that ;-(
>
Reply to: